This invention relates generally to the field of safety equipment used in elevator systems, and more particularly to a safety chain which is implemented using wireless communication.
The elevator controller, located in the machine room, interfaces to a number of devices in the hoistway and the hall. These devices are characterized into three functional area: user input devices (such as fixtures), diagnostic devices (non safety critical sensors) and safety chain devices (safety critical sensors). The current wired architecture includes a main trough that runs the length of the hoistway. From the main trough, smaller local conduit runs to each device in the hall fixture and safety chain systems. The hoistway devices are connected to the machine room via wires. These wires are usually enclosed in a rigid and non-rigid conduit. Local building codes regulate the size and material of the main trough and local conduit (metallic, plastic, flex or rigid). In addition, in some regions the local conduit is not required if appropriately insulated wire is used.
The system configuration depends on customer needs. Some elevators have a lantern on every floor, others have one only at the lobby. In a bank of elevators (multiple elevators side by side) there may be any number of buttons (not to exceed the number of elevators) depending on the customer requirement.
The safety circuit is a separate circuit with a discrete number of switches designed to indicate the status of the doors and the position of the elevator at the extremes of the hoistway (terminal switches). In addition there are a number of other switches designed to monitor the safety status of other elevator components. Some of these safety switches are controlled by the car such as the overspeed governor and the limit switch. Others are controlled by the doors, such as the switches and the locks of the landing doors. These switches are wired together in a serial circuit known as the xe2x80x9csafety chain.xe2x80x9d If this circuit is xe2x80x9copenxe2x80x9d, i.e. one of the physical switches is not closed, the elevator is deemed xe2x80x9cunsafexe2x80x9d and is shutdown by the controller.
Because of the critical nature of the safety chain, the latency, i.e., the amount of time it takes to query the status of the system, must be very small, approximately 100 ms. In addition, the system must fail in a safe manner, i.e., the malfunction of any of the components in the safety chain must not cause the elevator to operate in an unsafe manner.
U.S. Pat. No. 6,173,814 (Herkel et al.) discloses an electronic safety system having a dual redundant safety bus, incorporated herein by reference. The electronic safety system still requires a lot of wiring in the hoistway to handle the safety system communications.
Briefly stated, a wireless safety chain for an elevator system includes a base transceiver connected to a system controller. A plurality of safety chain components each includes a physical sensor such as a switch, and a wireless transceiver. The physical sensor monitors the component status. The wireless transceiver communicates among the other safety chain components and the system controller. The wireless safety chain preferably employs a token scheme, where a token is sent from the base transceiver to one component, which in turn sends the token to another component, and so on, until the token returns to the base transceiver. Failure of the token to return to the base transceiver in a predetermined amount of time signals that the elevator system is unsafe.
According to an embodiment of the invention, a safety chain for an elevator system includes a controller in wireless communication with a plurality of component nodes; each component node including at least one sensor and communication means for communicating with the controller; each sensor monitoring an operating condition of the elevator system, such that when the operating condition fails, the means for communicating with the controller is switched off; and means for sending at least one token from the controller to each component node and back to the controller, wherein failure of the token to return to the controller within a predetermined amount of time signals that the elevator system is unsafe.